LITTLE ROCK – Attorney General Rutledge today announced that she, along with 45 other attorneys general, has obtained a $1.25 million multistate settlement with Florida-based Carnival Cruise Line stemming from a 2019 data breach that involved the personal information of approximately 180,000 Carnival employees and customers nationwide. In total, 550 Arkansas residents were impacted by the breach. The State will receive $28,678.23 from the settlement.
“Protecting Arkansans’ personal information is a priority,” said Attorney General Rutledge, “Arkansans must trust businesses to protect their personal information from bad actors or be promptly notified if their data is exposed in a breach.”
In March 2020, Carnival publicly reported a data breach when an unauthorized actor gained access to certain Carnival employee e-mail accounts. The breach included names, addresses, passport numbers, driver’s license numbers, payment card information, health information, and a relatively small number of Social Security Numbers. Breach notifications sent to attorneys general offices stated that Carnival first became aware of suspicious email activity in late May of 2019, approximately 10 months before Carnival reported the breach. A multistate investigation ensued, focusing on Carnival’s email security practices and compliance with state breach notification statutes.
“Unstructured” data breaches like the Carnival breach involve personal information stored via email and other disorganized platforms. Businesses lack visibility into this data, making breach notification more challenging—and consumer risk rises with delays.
Under the settlement, Carnival has agreed to a series of provisions designed to strengthen its email security and breach response practices going forward. Those include:
Implementation and maintenance of a breach response and notification plan;
Email security training requirements for employees, including dedicated phishing exercises;
Multi-factor authentication for remote email access;
Password policies and procedures requiring the use of strong, complex passwords, password rotation, and secure password storage;
Maintenance of enhanced behavior analytics tools to log and monitor potential security events on the company’s network; and
Consistent with past data breach settlements, undergoing an independent information security assessment.
Connecticut, Florida, and Washington co-led the investigation, assisted by Alabama, Arizona, Arkansas, Ohio, and North Carolina, and joined by Alaska, Colorado, Delaware, the District of Columbia, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Dakota, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, West Virginia, Wisconsin, and Wyoming.
About Attorney General Leslie Rutledge
Leslie Carol Rutledge is the 56th Attorney General of Arkansas. Elected on November 4, 2014, and sworn in on January 13, 2015, she is the first woman and first Republican in Arkansas history to be elected as Attorney General. She was resoundingly re-elected on November 6, 2018. Since taking office, she has significantly increased the number of arrests and convictions against online predators who exploit children and con artists who steal taxpayer money through Social Security Disability and Medicaid fraud. Further, she has held Rutledge Roundtable meetings and Mobile Office hours in every county of the State each year, and launched a Military and Veterans Initiative. She has led efforts to roll back government regulations that hurt job creators, fight the opioid epidemic, teach internet safety, combat domestic violence and make the office the top law firm for Arkansans. Rutledge serves on committees for Consumer Protection, Criminal Law and Veterans Affairs for the National Association of Attorneys General. She also served as the former Chairwoman of the Republican Attorneys General Association.
A native of Batesville, she is a graduate of the University of Arkansas at Fayetteville and the University of Arkansas at Little Rock William H. Bowen School of Law. Rutledge clerked for the Arkansas Court of Appeals, was Deputy Counsel for former Governor Mike Huckabee, served as a Deputy Prosecuting Attorney in Lonoke County and was an Attorney at the Department of Human Services before serving as Counsel at the Republican National Committee. Rutledge and her husband, Boyce, have one daughter. The family has a home in Pulaski County and a farm in Crittenden County.